############################################
######### USER - DEFINED VARIABLES #########

specialPort="3333"
ICMPnum="42"
firewallIP="192.168.0.14"
dmxIP="192.168.1.1"
internalLowIP="192.168.1.0"
internalHiIP="192.168.1.255"
ipSubnet="192.168.1.0/24"

## DO NOT CHANGE ANYTHING BELOW THIS LINE ##
############################################
#iptables -F
#iptables -X

# User chains
iptables -N tcpfwd
iptables -N udpfwd
#iptables -N tcpout
#iptables -N udpout

echo "Resetting firewall rules"

# Allow DNS & DHCP to work
iptables -A udpfwd -p udp --sport 67 -j ACCEPT # Allow DHCP out
iptables -A udpfwd -p udp --dport 68 -j ACCEPT # Allow DHCP in
iptables -A udpfwd -p udp --dport 53 --sport 1024:65535 -j ACCEPT # Allow DNS out
iptables -A udpfwd -p udp --sport 53 --dport 1024:65535 -j ACCEPT # Allow DNS in

############################################
# Rule 1: Default policy == DROP
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

# Rule 2: Allow user-defined ports
iptables -A tcpfwd -p tcp --dport ${specialPort} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A udpfwd -p udp --dport ${specialPort} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Rule 3: Allow user-defined ICMP type numbers
iptables -A tcpfwd -p icmp --icmp-type ${ICMPnum} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Rule 4: Deny packets to FIREWALL machine
iptables -A tcpfwd -p tcp -d ${firewallIP} -j DROP
iptables -A udpfwd -p udp -d ${firewallIP} -j DROP

# Rule 5: Deny packets from within internal IP range
iptables -A tcpfwd -p tcp -s ${ipSubnet} -j DROP

# Rule 6: Block SYN packets to high ports
iptables -A tcpfwd -p tcp --dport 1024:65535 --syn -j DROP

# Rule 7: Allow established TCP traffic
iptables -A tcpfwd -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Rule 8: Block TCP packets with SYN & FIN bits set
iptables -A tcpfwd -p tcp --tcp-flags SYN,ACK,FIN,RST SYN,FIN

# Rule 9: Block Telnet
iptables -A tcpfwd -p tcp --dport 23 -j DROP
#iptables -A tcpout -p tcp --sport 23 -j DROP

# Rule 10: DROP packets to ports 32768:32775 (only incoming packets, outgoing should be allowed)
iptables -A tcpfwd -p tcp --dport 32757:32775 -j DROP
iptables -A udpfwd -p udp --dport 32757:32775 -j DROP

# Rule 11: DROP packets to ports 137:139 (only incoming packets, outgoing should be allowed)
iptables -A tcpfwd -p tcp --dport 137:139 -j DROP
iptables -A udpfwd -p udp --dport 137:139 -j DROP

# Rule 12: DROP packets to TCP 111 (only incoming packets, outgoing should be allowed)
iptables -A tcpfwd -p tcp --dport 111 -j DROP

# Rule 13: DROP packets to TCP 515 (only incoming packets, outgoing should be allowed)
iptables -A tcpfwd -p tcp --dport 515 -j DROP

# Rule 14: Mangle FTP control packets for minimum delay (Why --sport not --dport? Wouldnt incoming packets be destined for these services???)
iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos Minimize-Delay

# Rule 15: Manage SSH packets for minimum delay
iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
iptables -A tcpfwd -p tcp --dport ssh -j ACCEPT

# Rule 16: Mangle FTP data for maximium throughput
iptables -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput

iptables -A FORWARD -p tcp -j tcpfwd
iptables -A FORWARD -p udp -j udpfwd
#iptables -A OUTPUT -p tcp -j tcpout
#iptables -A OUTPUT -p udp -j udpout


